CVE-2026-94439

Summary

An HTTP server incorrectly handles CONNECT requests by continuing to process HTTP requests on a connection that should have been converted into a tunnel. This can lead to request smuggling where proxies and servers interpret the same connection data differently, potentially allowing attackers to manipulate how requests are processed.

Exploitability

Exploitation requires an intermediate proxy that properly interprets the CONNECT response as a tunnel, combined with a vulnerable server that continues processing HTTP requests on the same connection, making it moderately difficult but possible to exploit.

Blast radius

The impact is primarily limited to request smuggling scenarios in environments with proxy intermediaries, potentially allowing attackers to bypass security controls or manipulate request routing without direct data exposure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.590 or later to fix the HTTP/1 CONNECT handling behavior.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.